Error 691 MS-CHAP connection to an ASA5505 HELP! :(

[vickyleach1]

The firewall is set up for L2TP MSCHAP with RADIUS authentication. It connected fine then suddenly stopped working. Here is my troubleshooting so far:

The configuration on the firewall is perfect (it worked for a while then stopped so no surprises there), I verified IPSEC was running on my PC, I tested the authentication and connection through the VPN client and it works perfectly, the following hotfix is installed on my PC that is trying to connect:

http://support.microsoft.com/kb/980399/en-us

What else could be wrong?

It gets to "verifying user name and password..." then throws me the "Error 691: The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access server.

It cant be the username and password because I logged into the server, created a new user then tested that user with the L2TP Group policy group in the VPN client and it worked.

Help me please

[vickyleach1]

Oh yeah, and I have disabled anti-virus and my firewall

[Namit Agarwal]

Hi ,

Could you please provide the config on your ASA ? Also does your radius server have MS-CHAP enabled for the user account you are using ?

thanks,

Namit

[vickyleach1]

Ok worked out my issue:

You cannot use MS-CHAP v2 with an LDAP server setup. I changed it to PAP and it worked. Sorry thought the config was perfect as I had used it on another network but I remembered, I had not used the LDAP authentication on the other one.

Thanks for your input though

[Namit Agarwal · Accepted solution]

Hi Vicky,

Yes the protocol should match on the server i.e. the ASA and the user authentication type. That is the reason I had advised to check if the user authentication using Radius and the Server both have MSCHAP.

I guess your query has been answered. Please mark the post as answered if everything is ok.

Thanks,

Namit